You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: app/en/home/auth/secure-auth-production/page.mdx
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,24 +1,26 @@
1
1
---
2
-
title: "Secure Auth in Production"
3
-
description: "How to secure and brand your auth flows in production"
2
+
title: "Verify your users"
3
+
description: "How to verify your users and prevent phishing attacks"
4
4
---
5
5
6
-
# Secure and Brand the Auth Flow in Production
7
-
8
6
To keep your users safe, Arcade.dev performs a user verification check when a tool is authorized for the first time. This check verifies that the user who is authorizing the tool is the same user who started the authorization flow, which helps prevent phishing attacks.
9
7
10
-
There are two ways to secure your auth flows with Arcade.dev:
8
+
<Callouttype="info">
9
+
Interested in branding your auth flow? Check out our docs on [branding your auth flow](/home/auth-providers/branding-auth).
10
+
</Callout>
11
11
12
-
- Use the **Arcade user verifier** for development (enabled by default)
13
-
- Implement a **custom user verifier** for production
12
+
## Prevent phishing attacks by verifying your users
14
13
15
-
This setting is configured in the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard.
14
+
There are two ways to verify your users with Arcade.dev:
16
15
17
-
## Use the Arcade user verifier
16
+
- Use the **Arcade user verifier** for development. This is enabled by default when you create a new Arcade.dev account and works well with internal apps, solo projects, and proof-of-concept apps.
17
+
- Implement a **custom user verifier** for production. This is required for multi-user apps and agents, as it doesn't require your users to sign in to Arcade.dev and lets you fully control the design of the auth flow in your own application.
18
18
19
-
If you're building a proof-of-concept app or a solo project, use the Arcade user verifier. This option requires no custom development and is on by default when you create a new Arcade.dev account.
19
+
You can configure this in the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard.
20
20
21
-
This setting is configured in the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard:
21
+
## How to use Arcade's default user verifier
22
+
23
+
This option requires no custom development and is enabled by default when you create a new Arcade.dev account.
@@ -27,9 +29,7 @@ This setting is configured in the [Auth > Settings section](https://api.arcade.d
27
29
width="600"
28
30
/>
29
31
30
-
When you authorize a tool, you'll be prompted to sign in to your Arcade.dev account. If you are already signed in (to the Arcade Dashboard, for example), this verification will succeed silently.
31
-
32
-
The Arcade.dev user verifier helps keep your auth flows secure while you are building and testing your agent or app. When you're ready to share your work with others, implement a [custom user verifier](#build-a-custom-user-verifier) so your users don't need to sign in to Arcade.dev.
32
+
When a user authorizes a tool, they'll be prompted to sign in to their own Arcade.dev account. If they are already signed in (to the Arcade Dashboard, for example), this verification will succeed silently.
33
33
34
34
<Callouttype="info">
35
35
Arcade's default OAuth apps can *only* be used with the Arcade user verifier.
@@ -39,13 +39,13 @@ The Arcade.dev user verifier helps keep your auth flows secure while you are bui
In a production application or agent, end-users are verified by your code, not Arcade.dev. This allows you to fully control the user experience of the auth flow. To enable this, build a custom verifier route and add the URL to the Arcade Dashboard.
44
+
With a custom user verifier, users are verified by your verifier, not Arcade's.
45
45
46
-
When your users authorize a tool, Arcade.dev will redirect the user's browser to your verifier route with some information in the query string. Your custom verifier route must send a response back to Arcade.dev to confirm the user's ID.
46
+
When a user authorizes a tool, Arcade.dev will redirect the user's browser to your verifier route with some information in the query string. Your custom verifier route must send a response back to Arcade.dev to confirm the user's ID.
47
47
48
-
If you need help, join the [Implementing a custom user verifier](https://github.com/ArcadeAI/arcade-ai/discussions/486) GitHub discussion and we'll be happy to assist.
48
+
This allows you to fully control the user experience of the auth flow in your own application. To enable this, you will need to build a custom verifier route and add the URL to the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard.
0 commit comments